CVE-2018-9101: XSS
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launchpresenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mitel MiVoice Connect conferencing component (R1707-PREM SP1)to a version that resolves this vulnerability.Fixed in 21.84.5535.0 - Upgrade
Upgrade
Mitel ST 14.2to a version that resolves this vulnerability.Fixed in 19.49.5200.0 - Compensating control
Mitigate reflected XSS against the launch_presenter.php page by ensuring proper validation for the launch_presenter.php request handling in the Mitel conferencing component (MiVoice Connect and Mitel ST 14.2).
Event History
Frequently Asked Questions
What is the vulnerability ID for this Mitel MiVoice Connect vulnerability?
The vulnerability ID for this Mitel MiVoice Connect vulnerability is CVE-2018-9101.
What is the affected software for this vulnerability?
The affected software for this vulnerability is Mitel MiVoice Connect versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2 versions GA27 (19.49.5200.0) and earlier.
What is the severity of CVE-2018-9101?
The severity of CVE-2018-9101 is medium with a CVSS score of 6.1.
How can an attacker exploit CVE-2018-9101?
An attacker can exploit CVE-2018-9101 by conducting a reflected cross-site scripting (XSS) attack.
Are there any mitigation steps available for this vulnerability?
Yes, mitigation steps are provided in the Mitel Product Security Advisory 18-0003 and the associated security bulletin.